diff --git a/packages/cli/src/baseline/writeBaseline.ts b/packages/cli/src/baseline/writeBaseline.ts
new file mode 100644
index 00000000..2cd88cc9
--- /dev/null
+++ b/packages/cli/src/baseline/writeBaseline.ts
@@ -0,0 +1,51 @@
+import type { ExitResult, ScanResult } from '../config/types.js';
+import {
+  printBaselineWritten,
+  printBaselineError,
+} from '../ui/scan/printBaseline.js';
+import {
+  BASELINE_FILE,
+  collectBaselineEntries,
+  writeBaselineFile,
+} from './scanBaseline.js';
+
+/**
+ * Writes the current scan state as a baseline file and reports the outcome.
+ * Returns exitWithError: false so the caller exits cleanly.
+ * @param scanResult The full scan result to convert into baseline entries and write to disk
+ * @param cwd The current working directory to resolve the baseline file from
+ * @param asJson Whether to output results in JSON format (true) or console format (false)
+ * @returns An object indicating whether to exit with an error code (always false for this function)
+ */
+export async function writeBaseline(
+  scanResult: ScanResult,
+  cwd: string,
+  asJson: boolean,
+): Promise<ExitResult> {
+  const entries = collectBaselineEntries(scanResult);
+  let filePath: string;
+  try {
+    filePath = await writeBaselineFile(cwd, entries);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (asJson) {
+      console.log(JSON.stringify({ ok: false, error: message }, null, 2));
+    } else {
+      printBaselineError(message);
+    }
+    return { exitWithError: true };
+  }
+
+  if (asJson) {
+    console.log(
+      JSON.stringify(
+        { file: BASELINE_FILE, warningsStored: entries.length },
+        null,
+        2,
+      ),
+    );
+  } else {
+    printBaselineWritten(entries.length, filePath);
+  }
+  return { exitWithError: false };
+}
diff --git a/packages/cli/src/commands/scanUsage.ts b/packages/cli/src/commands/scanUsage.ts
index 37a66ed9..71455d4b 100644
--- a/packages/cli/src/commands/scanUsage.ts
+++ b/packages/cli/src/commands/scanUsage.ts
@@ -20,16 +20,10 @@ import { DEFAULT_EXAMPLE_FILE } from '../config/constants.js';
 import { checkGitignoreStatus } from '../services/git.js';
 import { promptNoEnvScenario } from './prompts/promptNoEnvScenario.js';
 import {
-  printBaselineWritten,
-  printBaselineError,
-} from '../ui/scan/printBaseline.js';
-import {
-  BASELINE_FILE,
-  collectBaselineEntries,
-  writeBaselineFile,
   loadBaselineFile,
   applyBaselineEntries,
 } from '../baseline/scanBaseline.js';
+import { writeBaseline } from '../baseline/writeBaseline.js';
 
 /**
  * Scans the codebase for environment variable usage and compares it with
@@ -196,47 +190,6 @@ export async function scanUsage(opts: ScanUsageOptions): Promise<ExitResult> {
   return { exitWithError: result.exitWithError };
 }
 
-/**
- * Writes the current scan state as a baseline file and reports the outcome.
- * Returns exitWithError: false so the caller exits cleanly.
- * @param scanResult The full scan result to convert into baseline entries and write to disk
- * @param cwd The current working directory to resolve the baseline file from
- * @param asJson Whether to output results in JSON format (true) or console format (false)
- * @returns An object indicating whether to exit with an error code (always false for this function)
- */
-async function writeBaseline(
-  scanResult: ScanResult,
-  cwd: string,
-  asJson: boolean,
-): Promise<ExitResult> {
-  const entries = collectBaselineEntries(scanResult);
-  let filePath: string;
-  try {
-    filePath = await writeBaselineFile(cwd, entries);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    if (asJson) {
-      console.log(JSON.stringify({ ok: false, error: message }, null, 2));
-    } else {
-      printBaselineError(message);
-    }
-    return { exitWithError: true };
-  }
-
-  if (asJson) {
-    console.log(
-      JSON.stringify(
-        { file: BASELINE_FILE, warningsStored: entries.length },
-        null,
-        2,
-      ),
-    );
-  } else {
-    printBaselineWritten(entries.length, filePath);
-  }
-  return { exitWithError: false };
-}
-
 /**
  * Recalculates statistics for a scan result after filtering usages.
  * @param scanResult The current scan result